GitHub Advisoryadvisory · npm
GHSA-j27p-hq53-9wgc OpenClaw affected by denial of service via unbounded URL-backed media fetch
HIGH
Official page ↗
- Aliases
- CVE-2026-29609
- Ecosystem
- npm
- Packages
- openclaw
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2026-02-18
Affected packages
• npm openclaw: < 2026.2.14 → fixed in 2026.2.14
Description
Summary
URL-backed media fetch handling allocated the entire response payload in memory (`arrayBuffer`) before enforcing `maxBytes`, allowing oversized responses to cause memory exhaustion.
Affected Versions
• `openclaw` (npm): {res.writeHead(200,{"content-type":"application/octet-stream"});for(let i=0;i<1024;i++)res.write(Buffer.alloc(1024*64));res.end();}).listen(18888)'
```
Impact
Availability loss via memory pressure from attacker-controlled remote media responses.
Mitigation
Until a patched release is available, disable URL-backed media inputs (or restrict to a tight hostname allowlist) and use conservative `maxBytes` limits.
Credits
Reported by @vincentkoc.
Related
Alias · CVE (1)
- CVE-2026-29609 OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire… vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness